[green] Version the pre-activation social card

[yyods]

Summary

• specify content-versioned public social assets
• bind Open Graph metadata to reviewed hash-prefixed PNG/SVG paths
• prevent stale CDN bytes from surviving an origin deployment

Production finding

The corrected origin PNG had SHA-256 7e7e037d…, but Cloudflare still served the prior c6ff1003… bytes at the unchanged URL. This change gives the corrected card a new pathname.

Validation

• cd tools/web && npm run check (160 tests plus format, lint, type, licenses, Next and vinext builds)
• publication, no-leak, SPDX, DCO, and diff checks